PT-2014-7814 · Puppet · Puppet Server

Publicado 2014-12-17 · Atualizado 2019-07-11 · CVE-2014-7170

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Puppet Server version 0.2.0

Description A race condition exists, allowing local users to obtain sensitive information by accessing it during a specific time window, namely between package installation or upgrade and the start of the service.

Recommendations For Puppet Server version 0.2.0, consider applying configuration changes to minimize the risk of exploitation, such as restricting access to sensitive information during the installation or upgrade process. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2014-7170

Produtos afetados

Puppet Server

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2014-7170 · Nota de Segurança
• http://puppetlabs.com/security/cve/cve-2014-7170 · Aviso do Fabricante